Domain

0000558.com

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .com TLD

Run a live full scan of 0000558.com

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

—

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

—

seen in DNS

Observed Certs

—

in our scans

DNS Records

3.173.161.39, 3.173.161.54, 3.173.161.72, 3.173.161.75

AAAA

2600:9000:2490:1e00:12:cb12:700:93a1, 2600:9000:2490:4600:12:cb12:700:93a1, 2600:9000:2490:5c00:12:cb12:700:93a1, 2600:9000:2490:800:12:cb12:700:93a1, 2600:9000:2490:9200:12:cb12:700:93a1, 2600:9000:2490:9400:12:cb12:700:93a1, 2600:9000:2490:a200:12:cb12:700:93a1, 2600:9000:2490:ee00:12:cb12:700:93a1

—

colin.ns.cloudflare.com, noor.ns.cloudflare.com

TXT

—

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain	Resolves to	Last seen
0000558.com	3.173.161.72 2600:9000:2490:ee00:12:cb12:700:93a1 2600:9000:2490:1e00:12:cb12:700:93a1 2600:9000:2490:a200:12:cb12:700:93a1 +8	2026-06-16 00:09:19.359
aa.0000558.com		1970-01-01 00:00:00.000
www.0000558.com		1970-01-01 00:00:00.000

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Certificate observations pending

TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.

IPs Citing This Domain

No citing IPs found yet

As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

CT-Log Evidence

Certificates from public Certificate Transparency logs whose subject or SAN names this domain — including historic certs we never observed live.

a614297c7175e99d… sectigo · elephant2026h1

Subject: 0000558.com

Issuer: Sectigo Public Server Authentication CA DV E36

SANs: 0000558.com, *.0000558.com

Valid: 2026-01-12 00:00:00 → 2026-04-12 14:13:03

b1cd97fe98eaaca0… sectigo · elephant2026h1

Subject: 0000558.com

Issuer: Sectigo Public Server Authentication CA DV E36

SANs: 0000558.com, *.0000558.com

Valid: 2026-01-12 00:00:00 → 2026-04-12 14:13:03

34205dbfeadc8d24… sectigo · elephant2026h1

Subject: 0000558.com

Issuer: Sectigo Public Server Authentication CA DV E36

SANs: 0000558.com, *.0000558.com

Valid: 2025-11-14 00:00:00 → 2026-02-12 12:09:56

da4188a6708257fd… sectigo · elephant2026h1

Subject: 0000558.com

Issuer: Sectigo Public Server Authentication CA DV E36

SANs: 0000558.com, *.0000558.com

Valid: 2025-11-14 00:00:00 → 2026-02-12 12:09:56

7175c3f2300492fc… google · argon2026h2

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M01

SANs: www.52849.cc, www.499732.com, www.634649.com, 181488.com, 646511.com, www.789364.com, www.646511.com, 499732.com, 293969.com, 5222277.com, 49957.cc, 52849.cc, 492120.com, 789364.com, www.678355.com, www.181488.com, 9444111.com, www.0000660.com, www.499734.com, www.5222244.com, 37349.cc, 499734.com, www.664251.com, 627649.com, 634649.com, 664251.com, 5222244.com, www.191488.cc, h5.168511.com, *.49630.xyz, www.862749.com, 885594.com, h5.492120.com, www.49363.vip, www.192488.cc, www.37349.cc, www.49957.cc, 636749.com, www.499754.com, h5.634649.com, 678355.com, 567546.com, www.49363.cc, 632849.com, www.181488.cc, 49937.cc, www.293969.com, 191488.com, www.789304.com, www.9444000.com, 862549.com, www.646511.cc, 789304.com, www.5222255.com, 625749.com, 181488.cc, www.862549.com, www.262549.com, www.23849.cc, www.567426.com, 191488.cc, 292749.com, www.664374.com, www.885546.com, 885546.com, h5.499754.com, h5.678355.com, www.885594.com, www.168511.com, www.49937.cc, www.292749.com, www.636749.com, 664374.com, 49363.cc, h5.49311.xyz, 262549.com, 567426.com, www.625749.com, 9444000.com, www.627649.com, 168511.com, www.191488.com, 49363.vip, www.632849.com, www.9444111.com, www.5222266.com, 0000558.com, 5222255.com, www.492120.com, 646511.cc, h5.293969.com, 23849.cc, www.567546.com, 499754.com, www.5222277.com, 192488.cc, 862749.com, 5222266.com

Valid: 2025-11-11 00:00:00 → 2026-12-10 23:59:59

f4744aecefc10a75… google · argon2026h2

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M01

Valid: 2025-11-11 00:00:00 → 2026-12-10 23:59:59

7175c3f2300492fc… cloudflare · nimbus2026

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M01

Valid: 2025-11-11 00:00:00 → 2026-12-10 23:59:59

f4744aecefc10a75… cloudflare · nimbus2026

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M01

Valid: 2025-11-11 00:00:00 → 2026-12-10 23:59:59

d9e9a69d46ef0f1a… google · xenon2026h1

Subject: 0000558.com

Issuer: WE1

SANs: 0000558.com, *.0000558.com

Valid: 2025-10-03 18:37:57 → 2026-01-01 19:35:24

8c987f2489dfccd8… cloudflare · nimbus2026

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M03

Valid: 2024-12-11 00:00:00 → 2026-01-09 23:59:59

8c987f2489dfccd8… google · argon2026h1

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M03

Valid: 2024-12-11 00:00:00 → 2026-01-09 23:59:59

8c987f2489dfccd8… google · xenon2026h1

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M03

Valid: 2024-12-11 00:00:00 → 2026-01-09 23:59:59

f0c4f15986d3997f… google · argon2026h1

Subject: www.52849.cc

Issuer: Amazon RSA 2048 M03

Valid: 2024-12-11 00:00:00 → 2026-01-09 23:59:59

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type	Value	First seen	Last seen
AAAA	2600:9000:2490:4600:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:5c00:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:1e00:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
NS	noor.ns.cloudflare.com	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
NS	colin.ns.cloudflare.com	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
A	3.173.161.75	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:ee00:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
A	3.173.161.39	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
A	3.173.161.54	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:9400:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
A	3.173.161.72	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:9200:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:800:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359
AAAA	2600:9000:2490:a200:12:cb12:700:93a1	2026-06-16 00:09:19.359	2026-06-16 00:09:19.359